Audit round 7: account for every clip that cannot be resolved

Ten lenses over v1.6.4..HEAD, every claim read against the code before
it was believed. Seven confirmed; six are here, one is recorded for the
next round. All of these are the same family — a failure wearing the
shape of success — which is the family that once shipped 9 MB of
ciphertext inside a main-movie m2ts at rc=0.

A clip whose extents cannot be resolved is now accounted for, in both
disc readers. Only `UdfUnrecordedExtent` used to count: every other way
`file_extents` can fail — a scratched sector under the clip's ICB
(DiscRead), an allocation-descriptor chain that never terminated, a file
whose data is embedded rather than extent-mapped — fell through to the
ordinary "file absent" path. On Blu-ray that yielded a title advertising
its full runtime with a clip's bytes silently missing, because the size
and the play-item timing had already counted it. On HD-DVD it was worse:
the clip was never added to `unusable`, so a split feature still composed
from FEATURE_1 alone and offered half a movie as the whole thing. Neither
emitted a single log line. Absence is still benign — a 2D disc has no
.ssif and the extension fallback exists for exactly that.

`Halted` is excluded deliberately, and that exclusion is the whole reason
the first version of this fix was wrong. Cancellation makes EVERY drive
command return `Halted`; classifying it as a disc defect would have
dropped each remaining playlist in turn and handed back a truncated title
list at success — the same defect, wearing a cancel. `parse_playlist`
returns Option and has no channel to propagate a halt, so the existing
behaviour is preserved rather than made worse. Propagating it properly is
next round's work.

Both log sites now emit the error's OWN code instead of a hardcoded 6017.
Accounting a scratched disc (E6000) as an authoring hole would send
anyone triaging it looking for the wrong thing entirely.

AD type 3 is embedded data, not a descriptor list (ECMA-167 4/14.6.8).
`read_icb_extents` lumped it in with the reserved values and decoded the
file's own CONTENT as (length, LBA) pairs, manufacturing extents out of
arbitrary bytes and pointing the reader at unrelated sectors. This same
release already taught `read_directory` to honour type 3; this is the
file half of that decision. It is an error rather than an empty list,
because an empty list reaches the caller as a clip that contributed
nothing while its declared duration still counts it — the silent loss
pointed the other way. A legally zero-length embedded file still returns
an empty list. New code E6018: reusing DiscRead would have mislabelled a
deterministic structural property as transient I/O and fed the retry and
NonTrimmed machinery a byte that will never change.

`file_extents_addressing`, `extents_abs_at` and `AbsExtent` drop to
`pub(crate)`. The first hands back unrecorded extents UNFLAGGED, in a
shape identical to the safe call's return; its doc says callers must use
`file_extents` instead, but a doc comment is not a guard. No dependent
crate references any of the three.

Three tests close gaps the audit found, each proven red before green:
a held AC-3 access unit must not resume as a normal frame after its track
poisons; the PS resume cursor must survive a drain that rebases it (three
separate mutants caught); and AD type 3 must be refused rather than
decoded. The first attempt at the HD-DVD test passed with the fix
reverted, which made it worthless — it needed a VTI fixture before the
composition path ran at all.

Also: four error codes were missing from the uniqueness test that claims
to cover every published code, so a new variant reusing 6014, 6016 or
6017 would have passed it.

src/error.rs

@@ -66,6 +66,7 @@ pub const E_UDF_NOT_FILESYSTEM: u16 = 6013;
 pub const E_IMAGE_TRUNCATED: u16 = 6015;
 pub const E_UDF_AD_CHAIN_TOO_LONG: u16 = 6016;
 pub const E_UDF_UNRECORDED_EXTENT: u16 = 6017;
+pub const E_UDF_EMBEDDED_DATA: u16 = 6018;
 
 // AACS (7xxx)
 pub const E_AACS_NO_KEYS: u16 = 7000;
@@ -430,6 +431,22 @@ pub enum Error {
     /// the declared size and report a mostly-empty file as a complete
     /// extraction, so the read fails instead.
     UdfAdChainTooLong,
+    /// A file's ICB declares its data EMBEDDED inline (ECMA-167 4/14.6.8
+    /// allocation-descriptor type 3), so it has no out-of-line extents at all.
+    ///
+    /// Returned only when a caller asked for a read plan over such a file.
+    /// The bytes in the allocation-descriptor field are then the file's own
+    /// CONTENT, not descriptors, so decoding them as (length, LBA) pairs
+    /// manufactures extents out of arbitrary data and points the reader at
+    /// unrelated sectors — a rip that completes at rc=0 carrying whatever
+    /// happened to be there. `read_directory` already refuses the same shape
+    /// for directories; this is the file half of that decision.
+    ///
+    /// A file that legitimately stores its data this way is tiny (an ICB caps
+    /// it at well under 2 KiB — the AACS `*.inf` key files are the usual
+    /// case), and the callers that expect one read it via `read_inline_data`
+    /// long before extents are ever requested. A stream file cannot be one.
+    UdfEmbeddedData,
     DiscTitleRange {
         index: usize,
         count: usize,
@@ -898,6 +915,7 @@ impl Error {
             Error::UdfNotFilesystem => E_UDF_NOT_FILESYSTEM,
             Error::UdfBufferTooSmall => E_UDF_BUFFER_TOO_SMALL,
             Error::UdfAdChainTooLong => E_UDF_AD_CHAIN_TOO_LONG,
+            Error::UdfEmbeddedData => E_UDF_EMBEDDED_DATA,
             Error::DiscTitleRange { .. } => E_DISC_TITLE_RANGE,
             Error::ShortImageRead { .. } => E_SHORT_IMAGE_READ,
             Error::EmptyImage => E_EMPTY_IMAGE,
@@ -1918,6 +1936,13 @@ mod tests {
             E_IMAGE_TRUNCATED,
             E_UDF_BUFFER_TOO_SMALL,
             E_UDF_NOT_FILESYSTEM,
+            // These four were absent, so the "every published code is unique"
+            // claim above did not actually cover them: a new variant reusing
+            // 6014, 6016 or 6017 would have passed this test.
+            E_SELECTION_PID_UNKNOWN,
+            E_UDF_AD_CHAIN_TOO_LONG,
+            E_UDF_UNRECORDED_EXTENT,
+            E_UDF_EMBEDDED_DATA,
             E_AACS_NO_KEYS,
             E_AACS_CERT_SHORT,
             E_AACS_AGID_ALLOC,